# NPM ACME Authority

Runtime ACME write fencing for Nginx Proxy Manager.

The project patches NPM certificate handling at container startup so that
selected Let's Encrypt mutation paths require a Pacemaker-controlled
authority token.

## Gate configuration

- `ACME_GATE_REQUEST=true`
- `ACME_GATE_RENEW=true`
- `ACME_GATE_REVOKE=true`

These variables determine which ACME operations require authority.

They do **not** grant authority.

## Runtime authority

Authority is represented by:

    /acme_authority/state/acme-authority

The intended production mapping is:

    /etc/npm-acme-authority  -> /acme_authority
    /run/npm-acme-authority -> /acme_authority/state

The persistent code mount is read-only.

The runtime state mount is read-only from the container's perspective and
is controlled by Pacemaker on the host.

## Intended policy

REQUEST:
- Gate Let's Encrypt creation before database insertion.

RENEW:
- Gate automatic and manual renewal before Certbot execution.

REVOKE:
- Gate certificate deletion before the database row is marked deleted.
- Gate Certbot revocation again as defense in depth.

## Safety

Requested mutations must fail closed.

If an expected NPM source anchor cannot be identified or verification fails,
the patcher must exit non-zero rather than start an ungated NPM backend.